YARA · Samir Bousseaden (YaraHunts)
SBOUSSEADEN_Susp_Msoffice_Addins_Wxll
hunt for suspicious MS Office Addins with code injection capabilities
- Author
- SBousseaden
- Date
- 2020-11-10
- Modified
- 2023-03-27
- Score / Quality
- 65 / 75
What this rule detects
hunt for suspicious MS Office Addins with code injection capabilities
Targets: Windows PE.
It defines 18 patterns (18 text, 0 hex, 0 regex). YARA modules used: pe.
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from Samir Bousseaden (YaraHunts), which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Licence & attribution
Author: SBousseaden
Source repository: Samir Bousseaden (YaraHunts) @ 71b27a2a7c
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 39d3b2af-f848-51c0-a13b-13c0fe3a79dd
Tags:FILE
Related rules
- SBOUSSEADEN_Hunt_Susp_VhdMetadata onlySuspicious / huntingSamir Bousseaden (YaraHunts)· SBousseaden· 2020-07-13
- SBOUSSEADEN_Mimikatz_KiwikeyMetadata onlyHack toolSamir Bousseaden (YaraHunts)· SBousseaden· 2020-08-08
- SBOUSSEADEN_Adsync_Creddump_V64Metadata onlyGenericSamir Bousseaden (YaraHunts)· SBousseaden· 2020-03-08
- SBOUSSEADEN_Adsync_Creddump_XorMetadata onlyGenericSamir Bousseaden (YaraHunts)· SBousseaden· 2020-03-08
- SBOUSSEADEN_Adsync_Creddump_XwideMetadata onlyGenericSamir Bousseaden (YaraHunts)· SBousseaden· 2020-03-08
- SBOUSSEADEN_APT_Solarwind_Backdoor_Encoded_StringsMetadata onlyAPT / threat actorSamir Bousseaden (YaraHunts)· SBousseaden· 2020-12-14
- SBOUSSEADEN_APT_Xdsspy_XduploadMetadata onlyAPT / threat actorSamir Bousseaden (YaraHunts)· SBousseaden· 2020-05-10
- SBOUSSEADEN_Cve_2019_1458Metadata onlyExploitSamir Bousseaden (YaraHunts)· SBousseaden· 2020-10-22